CVE-2024-13289
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in the Drupal Cookiebot + GTM module that allows attackers to inject malicious scripts into web pages. It affects all Drupal sites using vulnerable versions of this module, potentially compromising user sessions and data.
💻 Affected Systems
- Drupal Cookiebot + GTM module
📦 What is this software?
Cookiebot \+ Gtm by Usercentrics
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, deface websites, or redirect users to malicious sites, potentially leading to full site compromise.
Likely Case
Attackers inject malicious scripts to steal user session cookies or credentials, potentially gaining unauthorized access to user accounts.
If Mitigated
With proper input validation and output encoding, the impact is limited to potential script execution in specific contexts, but user data remains protected.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity and can be exploited by unauthenticated attackers if vulnerable endpoints are accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.18
Vendor Advisory: https://www.drupal.org/sa-contrib-2024-055
Restart Required: No
Instructions:
1. Update the Cookiebot + GTM module to version 1.0.18 or later via Drupal's update manager. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable vulnerable module
linuxTemporarily disable the Cookiebot + GTM module until patched
drush pm-disable cookiebot_gtm
Enable Drupal's built-in XSS protection
allEnsure Drupal's built-in XSS filters are active
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Restrict access to affected pages to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check the module version in Drupal's Extend page or via drush: drush pm-list | grep cookiebot_gtmCheck Version:
drush pm-list --fields=name,version | grep cookiebot_gtmVerify Fix Applied:
Confirm module version is 1.0.18 or higher and test input fields for proper sanitization📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with script tags or JavaScript payloads
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing script tags or JavaScript in parameters
- Unexpected outbound connections after page loads
SIEM Query:
source="web_logs" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=") AND uri="*cookiebot*"